Skip to content
OpenAdvisories

Archive

28 April 2022

Vulnerabilities first published on this day (UTC), newest first.

← March 2022 2022 / April /28 May 2022 →
  1. 1104
  2. 24
  3. 325
  4. 4107
  5. 5122
  6. 659
  7. 746
  8. 859
  9. 97
  10. 1039
  11. 11189
  12. 12166
  13. 1351
  14. 14110
  15. 15234
  16. 165
  17. 172
  18. 1898
  19. 19131
  20. 2044
  21. 21106
  22. 2248
  23. 231
  24. 244
  25. 2579
  26. 2636
  27. 2764
  28. 2860
  29. 2952
  30. 306
All Critical High Medium Low Exploited only Public exploit

22 results · Clear filters · Feed

  • Medium —
    GHSA-m98g-63qj-fp8j

    Reflected XSS on clients-registrations endpoint

    A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. When a malicious request is sent to the client registration endpoint, the error message is not properly escaped, allowing an attacker to execute malicious scripts in…

    org.keycloak:keycloak-parent Maven
  • Medium 4.9
    CVE-2022-24898

    Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml

    org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4, and 13.8-rc-1, it is possible for a script to access any file accessing to the user running XWiki ap…

    xwiki xwiki-commons org.xwiki.commons:xwiki-commons-xml Maven
  • Medium 5.4
    CVE-2022-29412

    WordPress Hermit 音乐播放器 plugin <= 3.1.6 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

    Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allow attackers to delete cache, delete a source, create source.

    Mufeng Hermit 音乐播放器 (WordPress plugin) Web / CMS
  • Medium 4.7
    CVE-2022-29413

    WordPress Hermit 音乐播放器 plugin <= 3.1.6 - Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability

    Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress via &title parameter.

    Mufeng Hermit 音乐播放器 (WordPress plugin) Web / CMS
  • Medium 5.4
    CVE-2022-22443

    IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed …

    IBM InfoSphere Information Server
  • Medium 6.5
    CVE-2022-22441

    IBM InfoSphere Information Server 11.7 could allow an authenticated user to view information of higher privileged users…

    IBM InfoSphere Information Server
  • Medium 5.2
    CVE-2022-22427

    IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed …

    IBM InfoSphere Information Server
  • Medium 5.4
    CVE-2022-22322

    IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed …

    IBM InfoSphere Information Server
  • Medium 5.4
    CVE-2021-38952

    IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed …

    IBM InfoSphere Information Server
  • Medium 6.1
    CVE-2022-29415

    WordPress Ravpage plugin <= 2.16 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

    Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in Mati Skiba @ Rav Messer's Ravpage plugin <= 2.16 at WordPress.

    Mati Skiba @ Rav Messer Ravpage (WordPress plugin) Web / CMS
  • Medium 6.1
    CVE-2022-27860

    WordPress Footer Text plugin <= 2.0.3 - Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability

    Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) in Shea Bunge's Footer Text plugin <= 2.0.3 on WordPress.

    Shea Bunge Footer Text (WordPress plugin) Web / CMS
  • Medium 6.5
    CVE-2022-22783

    Process memory exposure in Zoom on-premise Meeting services

    A vulnerability in Zoom On-Premise Meeting Connector Controller version 4.8.102.20220310 and On-Premise Meeting Connector MMR version 4.8.102.20220310 exposes process memory fragments to connected clients, which could be observed by a passive attacker.

    Zoom Video Communications Zoom On-Premise Meeting Connector MMR Zoom On-Premise Meeting Connector Controller
  • Medium 4.9
    CVE-2021-43930

    Elcomplus SmartPtt Path Traversal

    Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users to perform path traversal attacks and potentially download arbitrary files from the system.

    Elcomplus SmartPTT
  • Medium 6.4
    CVE-2022-24892

    Multiple valid tokens for password reset in Shopware

    Shopware is an open source e-commerce software platform. Starting with version 5.0.4 and before version 5.7.9, multiple tokens for password reset can be requested. All tokens can be used to change the password. This makes it possible for an attacker to take o…

    shopware shopware shopware/shopware Packagist
  • Medium 5.4
    CVE-2022-24873

    Non-Stored Cross-site Scripting in Shopware storefront

    Shopware is an open source e-commerce software platform. Prior to version 5.7.9, Shopware is vulnerable to non-stored cross-site scripting in the storefront. This issue is fixed in version 5.7.9. Users of older versions may attempt to mitigate the vulnerabili…

    shopware shopware shopware/shopware Packagist
  • Medium 6.9
    CVE-2022-29821

    In JetBrains Rider before 2022.1 local code execution via links in ReSharper Quick Documentation was possible

    JetBrains Rider
  • Medium 6.9
    CVE-2022-29819

    In JetBrains IntelliJ IDEA before 2022.1 local code execution via links in Quick Documentation was possible

    JetBrains IntelliJ IDEA
  • Medium 6.9
    CVE-2022-29815

    In JetBrains IntelliJ IDEA before 2022.1 local code execution via workspace settings was possible

    JetBrains IntelliJ IDEA
  • Medium 6.9
    CVE-2022-29814

    In JetBrains IntelliJ IDEA before 2022.1 local code execution via HTML descriptions in custom JSON schemas was possible

    JetBrains IntelliJ IDEA
  • Medium 6.9
    CVE-2022-29813

    In JetBrains IntelliJ IDEA before 2022.1 local code execution via custom Pandoc path was possible

    JetBrains IntelliJ IDEA
  • Medium 6.1
    CVE-2022-29811

    In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible.

    JetBrains Hub
  • Medium 6.5
    CVE-2022-1511

    Missing Authorization in snipe/snipe-it

    Missing Authorization in GitHub repository snipe/snipe-it prior to 5.4.4.

    snipe snipe/snipe-it snipe/snipe-it Packagist